The Most Dangerous AI Hacking Techniques Still Have Humans in the Loop

Agentic AI has permanently changed cybersecurity by making it quicker and easier to discover vulnerabilities in software and fix them—or develop so-called exploits to weaponize them. But longtime web security researcher James Kettle wanted to look beyond the bug-hunting apocalypse to explore a question that has taken on even more urgency as major AI organizations disclose real-world examples of rogue AI hacking: Can agentic AI develop novel, abstract hacking methods, from concept through to practical attacks?

At the Black Hat security conference in Las Vegas on Wednesday, Kettle presented his findings, which illustrate both AI’s rapidly advancing cybersecurity capabilities and its limitations. For now, the answer to Kettle’s question is nuanced. He concluded that AI is perhaps minimally capable but extremely limited in its ability to devise new attack paths in a fully autonomous way. Importantly, though, when paired with human guidance and insight in key moments, Kettle found that AI is an extremely powerful partner in conceptualizing and uncovering new strategies for hacking.

After spending years researching web security vulnerabilities , Kettle says he has uncovered an entirely new area of potential vulnerability—dubbed Shared-Parser Confusion—as the result of an AI revelation about web servers using shared code to process both requests and responses.

“This is an absolutely massive deal, because if you think about it, requests to a website are completely untrusted, they could be anything, but responses are trusted,” Kettle told WIRED ahead of his conference talk. “So this is a major attack surface and potentially spills into a lot of different attack types.”

The finding came out of months of experiments that began in September 2025 using Anthropic ’s and OpenAI’s latest models at the time. Kettle wanted to explore AI’s ability to do theoretical security research but quickly realized that one obstacle was that the systems were attempting to pass existing research off as original by returning findings about extremely esoteric topics that were difficult to vet. With this in mind, he decided to scope his tests more narrowly so the AI systems were working within his own area of web security expertise. This way he had total command of the material and knew that AI couldn’t trick him. Additionally, Kettle realized that by synthesizing his own research methodology and training models on it, he could probe deeper into what the systems were capable of extrapolating on their own.

“I’m interested in pushing AI to the absolute limit to see where it fails and where you need a human,” Kettle says. “There are still very few people talking about where the limits are, especially in the security space, because there aren’t incentives to talk about that angle. Everyone wants to be seen as AI native, not talk about where their system falls apart completely.”